One thing that works in Wave's favor is that waves are stored on the server that sent them, not the server that received them. This means that when a server (or user on a server) is disconnected for spamming, the waves they originated disappear from everyone's inbox.

How individual servers deal with malicious users and the disconnection/deletion process remains to be seen.

Also to be determined is what happens when spam content is added to a legitimate public wave. Presumably anyone else with access to that wave would have the ability to remove it (thus affecting everyone else on the wave as well) - this could be done by a bot.